How to Enforce 2-Step Verification in Google Workspace

Email is the account most small businesses cannot afford to lose. A stolen Google Workspace password gives an attacker the mailbox, Drive files, calendar and often the ability to reset passwords on other services. The NCSC Small Business Guide tells small businesses to use two-factor authentication on important accounts such as email, and that applies directly to Workspace.

The ICO makes a similar point for organisations holding personal data. Its ransomware guidance says not to rely on single-factor authentication for internet-facing services where access could expose personal data. Google Workspace sign-in is internet-facing, so a password-only setup is difficult to defend if a breach is investigated. The ICO also recommends strong passwords alongside MFA where possible, so enforcement does not replace your password policy.

Sign in to the Google Admin console as a super administrator and go to Security, then Authentication, then 2-Step Verification. From there you choose the organisational unit or group the setting applies to, configure the enforcement options and save. Google's own instructions for this are at support.google.com/a/answer/175197, and it is worth reading them on the day you make the change.

The options shown depend on your Workspace edition and the scope you have selected, and Google changes the console from time to time. Treat the screen in front of you as the authority rather than any written guide, including this one. Check the method controls on that page too, because the second-factor methods available to your users are set there and affect how staff will enrol.

The setting can be scoped to an organisational unit or a group, so you do not have to switch on enforcement for the whole company at once. A sensible order is administrators first, then a small pilot group such as the owner's team or office staff, then everyone else. Confirm the scope you have chosen in the console before saving, because applying it to the top-level organisational unit affects every user beneath it.

Before enforcement takes effect, tell staff the date and what will happen when they next sign in. Give them a window to enrol their second factor in advance rather than meeting the prompt for the first time while trying to open a client email. Google's enrolment steps for users are in its 2-Step Verification help at support.google.com/accounts/answer/185839, which you can link in your staff message.

Super administrator accounts can change security settings, reset other users and read or export data, so they are the highest-value targets in the domain. Enrol and test 2-Step Verification on these accounts before applying the setting to anyone else. Use named admin accounts rather than a shared login, and keep admin accounts separate from the mailbox used for daily work where you can.

Make sure at least two people can administer the domain and that both have working second factors. If your only super administrator loses their device while enforcement is on, you have a locked-out domain and a support case with Google. Testing sign-in from a private browser window after enrolment confirms the second factor works before you rely on it.

Decide how a member of staff recovers access before you enforce, not after the first phone is lost. Google allows users to hold backup codes, and administrators can handle recovery for users who are locked out. The exact recovery options available to you are in the Admin console and Google's help pages, so confirm them there and write your own short procedure from what you find.

Your procedure should state who verifies the identity of a person asking for recovery, how they are verified, and who records it. Verification by a phone call from a known number or in person is stronger than an email from the locked account. Tell staff to store backup codes somewhere separate from the device that holds the authenticator, such as a password manager, and not in an unlocked note on the same phone. Test the recovery process once with a pilot user so the first real lockout is not your first attempt.

After the setting is live, review who has enrolled and chase anyone who has not. The Admin console reporting for 2-Step Verification enrolment and enforcement shows which users are covered, though the exact report names depend on your edition. Check shared or service mailboxes, because accounts used by scanners, old integrations or third-party apps may break when a second factor is required.

Review the method controls again once most staff are enrolled. Where your edition allows it, favour stronger methods such as security keys or the Google prompt over text messages, but only restrict methods after everyone has a working alternative. Record the date enforcement started, the scope applied and the recovery procedure, so the next administrator can see what was done and why.